web-component-designer
web-component-designer copied to clipboard
XSS protection
I noticed that your preview canvas doesn't include the sandbox
attribute. This would introduce Cross-Site Scripting (XSS) vulnerabilities. A malicious web component would be able to make requests as the user.
If you use sandbox="allow-scripts"
then you'll close that vulnerability, but it also means redesigning your previous solution to use postMessage
for cross-domain communication.
where shoudl we use this? The sandbox attribute is for iframes, we don't use an iframe at the moment